INT-5777 - Ingest findings and account

[eXtremeX]

Added

• Updated SDK versions to v8

• Entities:

  Resources	Entity _type	Entity _class
  Account	sonarqube_account	Account
  Finding	sonarqube_finding	Finding

• Relationships:

  Source Entity _type	Relationship _class	Target Entity _type
  sonarqube_account	HAS	sonarqube_project
  sonarqube_account	HAS	sonarqube_user
  sonarqube_account	HAS	sonarqube_user_group
  sonarqube_project	HAS	sonarqube_finding

[VDubber]

Let's just add the name since the id (and the name) are already on the entities.

[VDubber]

Was this endpoint considered: api/projects/export_findings
https://next.sonarqube.com/sonarqube/web_api/api/projects/export_findings

[RPGPH]

This endpoint was initially part of the request in the ticket so we just followed that.

From your suggestion, I went ahead and looked into it and it seems like this is also the endpoint that SonarQube's UI queries when we go to the Issues page. There might be an advantage there since there is consistency in the data between the UI and our integrations.

This /export_findings endpoint's advantage seems like it also includes what SonarQube calls 'hotspots'. Hotspots are not a vulnerability per se, unlike Issues, but they can also be under certain circumstances.

We can definitely use it for this though. What do you think?

[VDubber]

Let's get a bit of data and then we can make a better call. Thanks for the details here!

[VDubber]

nit: add directly to jobState

[VDubber]

Looks great. Added a few comments.
Do we know what volume of data we are dealing with here?
Approving, please msg me for follow reviews/approvals.

[socket-security]

Socket Security Pull Request Report

👍 No new dependency issues detected in pull request

Pull request report summary

Issue	Status
Critical CVE	✅ 0 issues
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Unsafe copyright	✅ 0 issues
License change	✅ 0 issues
Missing license	✅ 0 issues
Mixed license	✅ 0 issues
License exception	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues
AI detected malware	✅ 0 issues

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore [email protected] [email protected]

Ignoring: [email protected]

Powered by socket.dev

[RPGPH]

Do we know what volume of data we are dealing with here?

I just used a single project for my test data but I think it would be similar to other repo scanning services out there.

[VDubber]

@SocketSecurity ignore [email protected]